This topic provides information about fields and tags. You can add fields and tags to your search criteria to narrow down your search results while investigating your log file data. These fields and tags are displayed under the Filter Pane on the Search tab.
Note
The number of fields and the unique values per field might have performance implications. For more information, see Variables that affect sizing and scalability.
This topic contains the following information:
About fields
When you assign a data pattern to a data collector, the tokens used in the data pattern are extracted as fields and are searchable as name=value pairs. If the data pattern contains the details token, the product looks for the equals sign (=) to use as a delimiter to extract the name=value pairs.
Note
Fields with multiple values are displayed as a comma-separated list on the Search tab.
In addition, for every data entry that is indexed, the product assigns certain fields based on the inputs specified at the the time of creating a data collector or by certain default settings, as described in the following table. These fields are treated as default fields and are displayed in the Filter Pane under My Fields on the Search tab. For every field, a count of occurrences is displayed in parentheses () next to the field name. If the number of occurrences is too large, an approximate count is displayed with a plus sign (+). When you expand such a field, the values show the approximate count with an asterisk (*) next to them. The plus sign next to the field name and the asterisk next to the field values indicate that the count for those fields or values is an approximate number, not an exact number. If you select one of the field values to add it to the search criteria and click Search, the accurate count is displayed next to that value.
Note
Under My Fields, you can delete all fields added manually, except for the defaults.
| User input | Field name |
|---|---|
Name Refers to the name specified to identify the data collector | COLLECTOR_NAME |
Server Name
| HOST |
Pattern Refers to the name of the data pattern used for creating the data collector | DATA_PATTERN |
Absolute file path retrieved from one or more of the user inputs:
| COLLECTOR |
Fields extracted for the BMC ProactiveNet Performance Management events as defined by the | mc_host pn_object_id pn_object_class_id mc_parameter severity mc_incident_time mc_arrival_time |
In addition to the default fields, you can add other fields to display under My Fields for use in further searches. For more information, see Searching with fields.
Note
The following fields are not available for searching:
- timestamp
- details
- SEQUENCE_ID
- _ignore
- utcdiffminutes
When you search for name=value pairs, the name is limited to the following characters:
- Letters (irrespective of case)
- Numbers (0 to 9)
- Underscore (_)
- Hyphen (-)
- Period (.)
About tags
You might have data with similar field values that can be grouped or categorized in a particular way. You can assign tags for such values while creating a data collector. These tags can be added to your search string to help improve your search. For more information, see Searching with tags.
For every tag, a count of occurrences is displayed in parenthesis () next to the tag name. If the number of occurrences is too large, an approximate count is displayed with a plus sign (+). When you expand such a tag, the values show the approximate count with an asterisk (*) next to them. The plus sign next to the tag name and the asterisk next to the tag values indicate that the count for those tags or values is an approximate number, not an exact number. If you select one of the tag values to add it to the search criteria and click Search, the accurate count is displayed next to that value.
To be able to assign tags while creating a data collector, you must first add them by navigating to Administration > System Settings. For example, if you have a field for the host name of computers that are used at various locations, you might want to assign a tag for the location from which the data is generated. You might also have tags for the department or the operating system from which the data is generated.
Related topics
Overview
Content Tools
Apps
Reporter Replacement
com.bmc.atlassian.bmc-util-plugin-2.section.label
Tasks